This Notice of Privacy Practices explains how health and financial information about the member may be used and shared and how the member can access it. It applies to all electronic and paper records Highmark creates, obtains, or maintains about the member as a member, and to all forms of communication of that information. It does not apply to Highmark in the context of being an employer.
Supporting quotations
THIS NOTICE DESCRIBES HOW HEALTH AND FINANCIAL INFORMATION ABOUT YOU MAY BE USED AND SHARED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This Notice applies to all electronic and paper records we create, obtain, or maintain about you as a member, as well as all forms of communication (oral, written, and electronic) of this information. This Notice does not apply to Highmark in the context of being an employer.
Legal Rights & Agreement Rules · Company commitment
Highmark's privacy responsibilities and combined notices
Highmark Health, including its wholly-owned health plan subsidiaries and affiliates, states it is required by law to maintain the privacy and security of health and non-public personal (financial) information and to provide notice of members' rights and its duties. This Notice combines the HIPAA notice of privacy practices and the GLBA privacy notice.
Supporting quotations
At Highmark Health, including its wholly-owned health plan subsidiaries and affiliates (Highmark), we value your privacy. When it comes to managing your information, we are required by law to maintain the privacy and security of your health and non-public personal (financial) information and to provide you with notice of your rights and our duties to keep your information safe and confidential. This Notice of Privacy Practices combines two required privacy notices:
Health Insurance Portability and Accountability Act (HIPAA) notice of privacy practices
Gramm Leach Bliley Act (GLBA) privacy notice
Not stated here
The GLBA privacy notice text is not supplied in this source; this card cannot describe its contents.
Data Access & Collection · Context
Protected Health Information (PHI) definition
PHI is health and financial information that identifies, or could be used to identify, the member and was created or received by a health care provider, health plan, health care clearinghouse, vendor performing activities on behalf of one of those organizations, or the employer if a group health plan, related to past, present, or future physical or mental health or condition, provision of health care, or payment for health care.
Supporting quotations
The information we collect is called Protected Health Information (PHI). PHI is health and financial information that identifies you, or could be used to identify you, and was created or received by a health care provider, a health plan, a health care clearinghouse, or vendor performing activities on behalf of one of these organizations, or your employer (if a group health plan), and is related to one of the following:
Your past, present, or future physical or mental health or condition;
Providing you with health care; and,
The past, present, or future payment for providing you with health care.
Sharing & Disclosure · Company practice
General use and sharing of PHI and non-public personal information
Highmark uses and shares PHI and other non-public personal information only as necessary to deliver products and services to members, operate its business, or comply with legal requirements. It shares with affiliated companies and non-affiliated third parties as permitted by law who assist in administering programs, coordinating care, and delivering products and services; contracts with service providers require confidentiality. Once information is shared with a third party other than a health care provider, health plan, or other person subject to federal privacy laws, it may no longer be subject to those privacy and security protections and the recipient may use or share it for other purposes.
Supporting quotations
We use and share PHI and other non-public personal information we collect only as necessary to deliver products and services to our members, to operate our business, or to comply with legal requirements.
Please be advised that once information is shared with a third party other than a health care provider, health plan, or other person subject to federal privacy laws – for example, if you fill out an authorization form directing us to share your PHI with a life insurance carrier – the information may no longer be subject to privacy and security protections, and the recipient may use or share that information for other purposes.
Security & Safeguards · Company commitment
Privacy protections and breach notification
Highmark restricts access to PHI and personal information to employees, agents, consultants, and health care providers who need it to provide products or services. It maintains physical, electronic, and procedural safeguards complying with state and federal regulations to protect personal information against unauthorized use, access, and disclosure, and will promptly notify the member if a breach may have compromised the privacy or security of PHI or non-public personal information.
Supporting quotations
We restrict access to your PHI and personal information to those employees, agents, consultants, and health care providers who need to know the information to provide products or services. We maintain physical, electronic, and procedural safeguards that comply with state and federal regulations to protect personal information against unauthorized use, access, and disclosure. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your PHI or non-public personal information.
Sharing & Disclosure · Company practice
Uses of PHI without written authorization: overview
Highmark has the right to collect, use, and share PHI, if needed, without written authorization while providing health benefits, and lists examples. It may also collect, use, and share information in other ways without authorization where it meets certain conditions in the law.
Supporting quotations
We have the right to collect, use, and share your PHI, if needed, without your written authorization while providing your health benefits. We have listed a few examples of how we use your information without authorization.
We may collect, use, and share your information in other ways without your authorization. We must meet certain conditions in the law before we can share your information for these purposes. The following are some of those examples.
Sharing & Disclosure · Company practice
Uses of PHI without authorization: treatment, payment, and operations
Without written authorization, Highmark may use and share PHI to manage the health care the member receives (including sharing with treating professionals), to pay for health services, to run its business and contact the member when necessary (including sharing among subsidiaries and affiliated entities), and to administer benefits (including sharing with a group health plan administrator).
Supporting quotations
Help manage the health care you receive: To manage the health care you receive, we can use your PHI and share it with health care professionals that are treating you.
Pay for your health services: We may use and share your PHI as we pay for your health services.
Run our business: We may use and share your PHI to run our business and contact you when necessary.
Administer your benefits: We may share your PHI with your group health plan administrator to perform administrative functions for the benefit plan in which you participate.
Sharing & Disclosure · Company practice
Uses of PHI without authorization: legal and public purposes
Without written authorization, Highmark may share PHI as required by federal or state law (including with the U.S. Department of Health and Human Services for compliance oversight); for public health and safety issues; in response to certain legal requests such as court or administrative orders or compliant subpoenas; with coroners, medical examiners, funeral directors, and organ/tissue donation organizations; for health research subject to certain criteria; for workers' compensation, law enforcement, health oversight, and special government functions; and for underwriting, although pricing coverage or denying coverage based on genetic information is prohibited.
Supporting quotations
As required by law: We may share your PHI if federal or state law requires the use or disclosure.
Help with public health and safety issues: We can share your PHI for certain situations such as:
Respond to lawsuits and legal actions: We may share your PHI in response to certain legal requests.
Respond to requests from coroners, medical examiners, funeral directors, and organ donation
agencies: We may share PHI with a coroner or medical examiner to identify deceased persons and the cause of death.
Do research: We can use or share your information for health research purposes, subject to certain criteria.
Address workers’ compensation, law enforcement, health oversight activities, and other
government requests: We can use or share your PHI when needed:
Underwriting Purposes: We may use or disclose PHI for underwriting purposes, but we are prohibited from pricing your coverage or denying you coverage based on genetic information.
Qualifications & exceptions
Underwriting use is permitted but pricing coverage or denying coverage based on genetic information is prohibited.
Data Access & Collection · Company practice
Cookies and online services
Highmark may collect information obtained when members visit and utilize Highmark websites or mobile device applications. Through cookies, pixels, and other digital tracking technologies, it may collect and share information about use of these digital services, pursuant to applicable laws, to operate its business and improve products and services.
Supporting quotations
Cookies and online services: We may collect information obtained when you visit and utilize Highmark websites (including My Highmark or other online benefit sites) or mobile device applications.
Sharing & Disclosure · Company practice
Business associates and supplemental digital policies
Highmark may contract with outside entities performing business services that may require use or access to PHI. These business associates are under written contract requiring protection of privacy and security of health information. PHI may be shared with a business associate to analyze use of websites and mobile applications, and may be used to develop, operate, and improve machine learning and other artificial intelligence solutions. Members are directed to review the Digital Privacy Policy and applicable Terms of Use for supplemental details regarding online services, collected information, and terms associated with a particular website or application.
Supporting quotations
Business Associates: We may contract with outside entities that perform business services for us that may require them to use or access your PHI.
Not stated here
The Digital Privacy Policy and Terms of Use referenced for supplemental online-service details are not supplied in this source; this card cannot describe their contents.
Sharing & Disclosure · Company practice
Health Information Exchange (HIE)
Highmark may participate in Health Information Exchanges, which may be opt-in or opt-out. An HIE is a secure electronic data sharing network allowing sharing of health information with other healthcare entities participating in the member's care for treatment, payment, and healthcare operations. Even if a member opts out, information may still be shared in other ways authorized or allowed by law.
Supporting quotations
Health Information Exchange (HIE): We may participate in certain Health Information Exchanges (HIEs), which may be an opt-in or opt-out model.
Qualifications & exceptions
Opt-out prevents access through an HIE but does not prevent other authorized or legally allowed sharing.
Sharing & Disclosure · Company practice
Organized Health Care Arrangement (OHCA)
Highmark and its affiliated healthcare provider system Allegheny Health Network participate in an OHCA to conduct analysis for quality assessment and improvement, utilization review, and related activities. Individual PHI may be accessed, used, and/or disclosed as necessary to carry out treatment, payment, or healthcare operations relating to the OHCA.
Supporting quotations
Organized Health Care Arrangement (OHCA): Highmark and its affiliated system of healthcare providers, Allegheny Health Network (AHN), participate in an OHCA
Sharing & Disclosure · Company practice
Inmates of correctional institutions
If the member is an inmate of a correctional institution, Highmark may share PHI with the correctional institution to provide health care or to protect the health and safety of the member or others.
Supporting quotations
Inmates. If you are an inmate of a correctional institution, we may share your PHI with the correctional institution to provide you with health care, or to protect your health and safety or the health and safety of others.
Sharing & Disclosure · Restriction or exception
Uses and disclosures requiring written authorization
Highmark must obtain written authorization to use or disclose PHI for certain marketing purposes, to sell information, to share substance use disorder counseling notes, and to share psychotherapy notes.
Supporting quotations
Sometimes we are required to obtain your written authorization for the use and disclosure of your PHI.
To use your PHI for certain marketing purposes;
To sell your information;
To share your substance use disorder counseling notes; and
To share your psychotherapy notes.
Cross-references
narrows (model-proposed): Uses of PHI without written authorization: overview — exception_to: Certain uses and disclosures require written authorization even though PHI may otherwise be used and shared without authorization for treatment, payment, and operations.
Legal Rights & Agreement Rules · User right or choice
Withdrawal of authorization
Highmark will not use or share information other than as described in the Notice or as permitted or required by applicable law unless the member authorizes it in writing. The member may change their mind at any time by notifying Highmark in writing. Withdrawal is effective for future uses and disclosures and does not affect uses or disclosures already made under the previous authorization.
Supporting quotations
We will not use or share your information other than as described in this Notice, or as permitted or required by applicable law, unless you tell us we can in writing.
Cross-references
qualifies (model-proposed): Uses and disclosures requiring written authorization — qualifies: Withdrawal of authorization is effective only for future uses and disclosures and does not affect disclosures already made under the prior authorization.
Legal Rights & Agreement Rules · Company commitment
Compliance with stricter state and federal laws
Highmark must comply with federal and state laws when they offer greater privacy protection for certain types of PHI, and will follow the stricter laws related to use and sharing of sensitive PHI, including genetic information; HIV/AIDS testing, diagnosis, or treatment; venereal or communicable disease testing, diagnosis, or treatment; alcohol or drug abuse prevention, treatment, and referral; and psychotherapy notes.
Supporting quotations
We are required to comply with federal and state laws when they offer greater privacy protection for certain types of PHI.
Genetic information;
HIV/AIDS testing, diagnosis, or treatment;
Venereal or communicable disease testing, diagnosis, or treatment;
Alcohol or drug abuse prevention, treatment, and referral;
Highmark may collect, use, and share other non-public personal information to administer health and benefit programs. Personal information identifies the member and may include name, address, telephone number, date of birth, Social Security number, or information relating to health care services or premium payment history. It is collected from the member or from others such as doctors, hospitals, or other insurers, and may be shared with third parties without authorization as permitted or required by law, with an opt-out opportunity when required.
Supporting quotations
We may also collect, use, and share other non-public personal information to administer our health and benefit programs.
For certain health information, members can tell Highmark their choices about what it shares. Highmark may share information with family or close friends involved in care or payment unless told not to, or based on professional judgment if the member cannot provide permission; in disaster relief situations; and may use or share name, address, phone number, and service dates to contact the member for fundraising, consistent with applicable laws.
Supporting quotations
For certain health information, you can tell us your choices about what we share.
Under certain circumstances, we may share your PHI with your family or close friends that you have identified as being involved in your health care or payment for your health care, unless you tell us not to do so.
We may share your information in a disaster relief situation.
We may use or share your name, address, phone number, and the dates you received services to contact you to support our fundraising efforts, consistent with applicable laws.
Account & Service Control · User right or choice
Individual rights: overview
When it comes to health information, members have certain rights. Any request must be in writing and signed by the member or authorized representative. Information about submitting a request is available via the Customer Service phone number on the back of the Member ID card or in writing to the contact listed at the end of the Notice.
Supporting quotations
When it comes to your health information, you have certain rights. The following is a description of those rights. Any request must be in writing and signed by you or your authorized representative.
Account & Service Control · User right or choice
Right to get a copy of health and claims records
Members can ask to review or receive copies of health and claims records Highmark has in a designated record set. Highmark will provide a copy or summary and may charge a reasonable cost-based fee.
Supporting quotations
Get a copy of your health and claims records: You can ask to review or receive copies of your health and claims records that we have about you in a designated record set.
Account & Service Control · User right or choice
Right to an accounting of disclosures
Members can ask for a list of times PHI was shared for reasons other than treatment, payment, health care operations, or authorized disclosures. The requested date range is limited to six years before the date of the request.
Supporting quotations
Get a list of those with whom we have shared information: You can ask for a list (an “accounting”) of the times we have shared your PHI that are for reasons other than treatment, payment, health care operations, or those which you authorized.
Account & Service Control · User right or choice
Right to ask to limit use or sharing
Members can ask Highmark not to use or share certain health information for treatment, payment, or operations. Highmark is not required to agree and may decline if inconsistent with law, policy, or business operations.
Supporting quotations
Ask us to limit what we use or share: You can ask us not to use or share certain health information about you for treatment, payment, or our operations.
Account & Service Control · User right or choice
Right to request confidential communications
Members can ask Highmark to contact them in a specific way or at a different address if sharing PHI could place them in danger, for example only at a work address or work email.
Supporting quotations
Request confidential communications: You can ask us to contact you in a specific way, or at a different address, if you believe that sharing your PHI could place you in danger.
Account & Service Control · User right or choice
Right to ask to correct or amend records
Members can ask Highmark to correct or amend health and claims records they believe are incorrect or incomplete. The request must explain why correction is needed. Highmark may decline but will explain why in writing.
Supporting quotations
Ask us to correct or amend health and claims records: You can ask us to correct, or amend, your health and claims records if you believe they are incorrect or incomplete.
Account & Service Control · User right or choice
Right to choose someone to act for you
If someone has medical power of attorney or is a legal guardian or other authorized representative, that person can exercise the member's rights and make choices about health information. Highmark will verify the person's authority before acting.
Supporting quotations
Choose someone to act for you: If you have given someone medical power of attorney or if someone is your legal guardian or other authorized representative, that person can exercise your rights and make choices about your health information.
Account & Service Control · User right or choice
Right to get a paper copy of the Notice
Members can ask for a paper copy of the Notice even if they agreed to receive it electronically.
Supporting quotations
Get a paper copy of this Notice: You can ask for a paper copy of this Notice, even if you have agreed to receive the Notice electronically.
Legal Rights & Agreement Rules · Company practice
Changes to the terms of the Notice
Highmark may revise the terms of the Notice on an ongoing basis. Any changes apply to all information Highmark has about the member. If the Notice significantly changes, the new Notice will be available upon request, on the website, and mailed in the annual mailing.
Supporting quotations
On an ongoing basis, it may become necessary to revise the terms of this Notice. Any changes will apply to all information we have about you.
Legal Rights & Agreement Rules · User right or choice
Complaints and no retaliation
Members may complain to Highmark using the listed contact (Privacy Operations, 120 Fifth Avenue Place, Suite 2114, Pittsburgh, PA 15222, 1-800-985-2050, HighmarkHealthPrivacy@highmarkhealth.org) or to the U.S. Department of Health and Human Services (Office for Civil Rights, 200 Independence Avenue S.W., Washington, D.C. 20201, 1-877-696-6775, hhs.gov/ocr/privacy/hipaa/complaints). Highmark supports the right to protect PHI privacy and will not retaliate for filing a complaint with Highmark or HHS.
Supporting quotations
If you want more information about our privacy practices or are concerned that we may have violated your privacy rights, you can complain to us using the following contact information:
You may also file a complaint with the U.S. Department of Health and Human Services by using the following contact information:
We support your right to protect the privacy of your PHI. We will not retaliate in any way if you choose to file a complaint with us or with the U.S. Department of Health and Human Services.
Legal Rights & Agreement Rules · Context
Effective date
Highmark must follow the privacy practices described in the Notice while it is in effect. The Notice is revised and effective as of Sept. 2025 and remains in effect unless replaced.
Supporting quotations
We must follow the privacy practices described in this Notice while it is in effect. This Notice is revised and effective as of Sept. 2025 and will remain in effect unless we replace it.
Legal Rights & Agreement Rules · Context
Additional provisions for substance use disorder (SUD) records
Additional provisions apply only to federally regulated SUD records. SUD records are protected by federal and state privacy laws. Unless specifically indicated, SUD records have the same protections and members have the same rights as described elsewhere in the Notice. The provisions identify added protections required by law.
Supporting quotations
ADDITIONAL PROVISIONS: PRIVACY PRACTICES RELATED TO SUBSTANCE USE DISORDER (SUD) RECORDS
These additional provisions to this Notice apply only to federally regulated SUD records.
Cross-references
qualifies (model-proposed): Notice of Privacy Practices: purpose and scope — qualifies: The additional SUD provisions apply only to federally regulated SUD records and add protections beyond the general Notice.
Sharing & Disclosure · Company practice
SUD records: use and sharing
For PHI collected by a SUD program governed by federal regulations, consent is obtained for all future uses or disclosures for treatment, payment, and healthcare operations before sharing. Consent may also be obtained to disclose SUD records to prevent multiple enrollments in withdrawal management or maintenance treatment programs, or to persons within the criminal justice system who have made participation a condition of disposition of criminal proceedings or parole/release, as permitted by applicable privacy laws. Consent is usually obtained when treatment begins. Except as described, any other uses or disclosures of SUD records require written consent. Records shared with consent to a third party regulated by federal privacy laws may be further disclosed by that third party without written consent to the extent permitted by federal privacy laws. SUD records may be used and shared without consent for medical emergencies, scientific research, management audits, financial audits, program evaluation, and disclosures to public health authorities when records are de-identified.
Supporting quotations
For PHI collected by a SUD program governed by federal regulations, your consent will be obtained for all future uses or disclosures for treatment, payment, and healthcare operations before sharing such information consistent with applicable privacy laws.
Records that we share with your consent to a third party regulated by federal privacy laws may be further disclosed, without your written consent, by the third party, to the extent permitted by federal privacy laws.
We may use and share SUD records without your consent for the following reasons when all conditions required by federal law are met: medical emergencies, scientific research, management audits, financial audits, program evaluation, and disclosures to public health authorities when the health records are de-identified.
Legal Rights & Agreement Rules · Restriction or exception
Prohibition on using SUD records in proceedings
Highmark will not use or share SUD records, or provide testimony based on such information, in any civil, criminal, administrative, or legislative proceedings against the member unless the member provides written consent, or a special type of court order is obtained and the member has had the opportunity to object.
Supporting quotations
We will not use or share your SUD records (or provide testimony based on such information) in any civil, criminal, administrative, or legislative proceedings against you, unless you have provided your written consent, or a special type of court order has been obtained, and you have had the opportunity to object.
Account & Service Control · User right or choice
SUD records and fundraising opt-out
Highmark will only use or share records to fundraise for the benefit of a SUD treatment program if the member is first provided an option to elect not to receive fundraising communications. A member can request to no longer receive fundraising communications following participation in a SUD program, even if initially permitted.
Supporting quotations
We will only use or share records to fundraise for the benefit of a SUD treatment program if you are first provided with an option to elect not to receive fundraising communications.
You can request to no longer receive fundraising communications following your participation in a SUD program, even if you initially permitted us to send such communications.
Legal Rights & Agreement Rules · Context
Highmark entity and regional licensee scope
Highmark Health includes wholly-owned subsidiaries and affiliates making up the Highmark Health enterprise, including Highmark Inc., Highmark Wholecare, Highmark Health Options, Allegheny Health Network, enGen, Helion, HM Insurance Group, and United Concordia Companies Inc. References to 'us,' 'we,' and 'our' mean Highmark Health. References to 'Highmark' are to the Highmark company providing the member's health benefits or benefit administration and/or one or more affiliated Blue companies. Benefits or administration may be provided by or through listed independent licensees of the Blue Cross Blue Shield Association by region (Western and Northeastern PA, Central and Southeastern PA, Delaware, West Virginia, Western NY, Northeastern NY).
Supporting quotations
*Highmark Health includes the wholly-owned subsidiaries and affiliates making up the Highmark Health enterprise
All references to “Highmark” in this document are references to the Highmark company that is providing the member’s health benefits or health benefit administration and/or to one or more of its affiliated Blue companies.
Western and Northeastern PA: Highmark Inc. d/b/a Highmark Blue Cross Blue Shield
Central and Southeastern PA: Highmark Inc. d/b/a Highmark Blue Shield, Highmark Benefits Group Inc., Highmark Health Insurance Company, Highmark Choice Company, Highmark Senior Health Company, or Gateway Health Plan, Inc. d/b/a Highmark Wholecare.
Delaware: Highmark BCBSD Inc. d/b/a Highmark Blue Cross Blue Shield or Highmark BCBSD Health Options Inc. d/b/a Highmark Health Options.
West Virginia: Highmark West Virginia Inc. d/b/a Highmark Blue Cross Blue Shield, Highmark Health Insurance Company, Highmark Senior Solutions Company, or Highmark Health Options West Virginia Inc. d/b/a Highmark Health Options and Highmark Blue Cross Blue Shield.
Western NY: Highmark Western and Northeastern New York Inc. d/b/a Highmark Blue Cross Blue Shield.
Northeastern NY: Highmark Western and Northeastern New York Inc. d/b/a Highmark Blue Shield.